CVE-2026-21493: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21493 is a Type Confusion vulnerability in the iccDEV library's CIccSingleSampledeCurveXml class during XML Curve Serialization. It affects iccDEV versions 2.3.1.1 and below — a set of open-source libraries and tools for working with ICC color management profiles maintained by the International Color Consortium. The vulnerability was reported on December 24, 2025, and the security advisory was published on January 3–6, 2026. It carries a CVSS v3.1 base score of 6.6 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is a class name typo (CIccSinglSampledeCurveXml vs. CIccSingleSampledeCurveXml) that caused an invalid C++ downcast in IccXML/IccLibXML/IccMpeXml.cpp at line 1032. When the ToXmlCurve() function processes a curve of type icSigSingleSampledCurve, it incorrectly casts a CIccSingleSampledCurve object pointer to the misnamed XML subclass, resulting in undefined behavior detected by UndefinedBehaviorSanitizer (UBSan). This maps to CWE-843 (Type Confusion), CWE-188 (Reliance on Data/Memory Layout), and CWE-703 (Improper Check or Handling of Exceptional Conditions). The attack vector is local and requires user interaction — a user must open or process a specially crafted ICC profile file (e.g., a CMYK 3D LUT .icc file) to trigger the flaw (GitHub Issue #358, Fix Commit).

Successful exploitation can result in high availability impact (application crash or instability), low confidentiality impact, and low integrity impact on the affected system. Because the vulnerability triggers undefined behavior via an invalid downcast, it may corrupt memory in ways that could be leveraged for further exploitation, though no such escalation has been demonstrated publicly. The attack surface is limited to local users or processes that parse untrusted ICC profile XML data, reducing the risk of widespread exploitation (GitHub Advisory).

A proof-of-concept is publicly available via the GitHub issue report, which demonstrates triggering the type confusion using the iccToXml tool with a crafted CMYK 3D LUT ICC profile file (iccToXml CMYK-3DLUTs/CMYK-3DLUTs2.icc CMYK-3DLUTs2.xml) (GitHub Issue #358). There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of exploitation in the near term (Red Hat CVE).

1. Prepare a malicious ICC profile: Obtain or craft a CMYK ICC profile file (e.g., a 3D LUT .icc file) that contains a SingleSampledCurve element in its XML representation, targeting the vulnerable serialization path.
2. Deliver the file to the target: Social-engineer or otherwise cause a user running a vulnerable version of iccDEV (≤ 2.3.1.1) to open or process the crafted ICC profile file using an application that invokes the iccDEV library.
3. Trigger the type confusion: When the application calls iccToXml or any function invoking ToXmlCurve() on the profile, the code at IccXML/IccLibXML/IccMpeXml.cpp:1032 performs an invalid downcast from CIccSingleSampledCurve to the misnamed CIccSinglSampledeCurveXml, triggering undefined behavior.
4. Achieve impact: The undefined behavior results in a crash (availability impact) or potential memory corruption, as confirmed by UBSan output showing an invalid vtable pointer dereference (GitHub Issue #358).

• Process: Application crashes or abnormal termination when processing ICC profile files; UBSan runtime error messages referencing IccXML/IccLibXML/IccMpeXml.cpp:1032 or 1034 in logs.
• Logs: UndefinedBehaviorSanitizer output containing strings such as downcast of address ... which does not point to an object of type 'CIccSinglSampledeCurveXml' or vptr for 'CIccSingleSampledCurve'.
• File System: Presence of unexpected or untrusted .icc profile files (particularly CMYK 3D LUT profiles) in directories processed by iccDEV-based applications.
• Network: Delivery of .icc or .xml files from untrusted external sources to systems running iccDEV-based tools (GitHub Issue #358).

Upgrade iccDEV to version 2.3.1.2 or later, which corrects the class name typo and resolves the invalid downcast (fix commit 7ff76d1, fix PR #359) (Fix Commit, GitHub Advisory). No official workarounds are provided by the maintainers. As interim measures, restrict processing of ICC profile files to trusted sources only, and avoid exposing iccDEV-based tools to untrusted input until patched.

The vulnerability was reported by security researcher xsscx (D. Hoyt) on December 24, 2025, and remediated by ChrisCoxArt as the fix developer. The GitHub advisory was published at a "Moderate" severity rating. No significant broader media coverage or notable community commentary beyond the GitHub issue and advisory has been identified (GitHub Advisory).